package com.bizihang.common.security.server;

import com.bizihang.common.security.app.authentication.openid.OpenIdAuthenticationSecurityConfig;
import com.bizihang.common.security.core.authentication.FormAuthenticationSecurityConfig;
import com.bizihang.common.security.core.authentication.mobile.SmsCodeAuthenticationSecurityConfig;
import com.bizihang.common.security.core.authorize.AuthorizeManager;
import com.bizihang.common.security.core.code.ValidateCodeSecurityConfig;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfiguration;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
import org.springframework.security.oauth2.provider.expression.OAuth2WebSecurityExpressionHandler;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.social.security.SpringSocialConfigurer;

/**
 * oauth2 资源服务器配置
 * {@link EnableResourceServer}默认注册了一个{@link ResourceServerConfiguration},主要有以下功能：
 *
 * <ul>
 * <li>做一个{@link WebSecurityConfigurerAdapter},order = 3,注意和资源服务器的做对比</li>
 * </ul>
 *
 * @author 毕子航 951755883@qq.com
 * @date 2018/10/21
 */
@Configuration
@EnableResourceServer
public class AppResourceServerConfig extends ResourceServerConfigurerAdapter {

	@Autowired
	protected OAuth2WebSecurityExpressionHandler oAuth2WebSecurityExpressionHandler;

	@Autowired
	protected AccessDeniedHandler accessDeniedHandler;

	@Autowired(required = false)
	protected SmsCodeAuthenticationSecurityConfig smsCodeAuthenticationSecurityConfig;

	@Autowired(required = false)
	protected ValidateCodeSecurityConfig validateCodeSecurityConfig;

	@Autowired(required = false)
	protected SpringSocialConfigurer pcSocialSecurityConfig;

	@Autowired
	protected AuthorizeManager authorizeConfigManager;

	@Autowired
	protected FormAuthenticationSecurityConfig formAuthenticationConfig;

	@Autowired(required = false)
	protected OpenIdAuthenticationSecurityConfig openIdAuthenticationSecurityConfig;

	@Override
	public void configure(HttpSecurity http) throws Exception {
		//表单模块注册
		formAuthenticationConfig.configure(http);

		//校验码模块
		if (null != validateCodeSecurityConfig) {
			http.apply(validateCodeSecurityConfig);
		}

		if (null != smsCodeAuthenticationSecurityConfig) {
			http.apply(smsCodeAuthenticationSecurityConfig);
		}

		if (null != pcSocialSecurityConfig) {
			http.apply(pcSocialSecurityConfig);
		}

		if (null != openIdAuthenticationSecurityConfig) {
			http.apply(openIdAuthenticationSecurityConfig);
		}
		http.headers().frameOptions().disable()
				.and()
				.exceptionHandling().accessDeniedHandler(accessDeniedHandler)
				.and()
				.csrf().disable();

		//授权模块配置
		authorizeConfigManager.config(http.authorizeRequests());
	}

	@Override
	public void configure(ResourceServerSecurityConfigurer resources) {
		resources.expressionHandler(oAuth2WebSecurityExpressionHandler);
	}
}